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INTRODUCTION 


The Review Process 


Section 99(2) of the Personal Health Information Protection Act, 2004 (PHIPA) 
provides that sections 1-72 and 75-98 of the Act come into force on November 1, 
2004. The statutory review provision in PHIPA is section 75 which reads as 
follows: 


75. A committee of the Legislative Assembly 
shall, 


(a) begin a comprehensive review of this Act 
not later than the third anniversary of the day on 
which this section comes into force; and 


(b) within one year after beginning this review, 
make recommendations to the Assembly 
concerning amendments to this Act.! 


The provincial election in October 2007 delayed the fulfillment of the review 
requirements. In accordance with section 75(a) and with a motion passed in the 
Legislative Assembly of Ontario on June 3, 2008, the Standing Committee on 
Social Policy held public hearings at Queen’s Park on August 28, 2008.” Notice 
of the hearings was posted on the Ontario Parliamentary Channel and the 
Legislative Assembly website. 


The Standing Committee issued an invitation to the Information and Privacy 
Commissioner/Ontario (IPC) to appear before the Committee. The Committee 
also notified 28 organizations that public hearings were taking place, and invited 
them to make submissions. All groups and individuals who contacted the 
Committee Clerk by 5:00 p.m. on Friday, August 8, 2008, were scheduled as 
witnesses at the public hearings. 


In addition to hearing from 15 witnesses, the Committee also received 18 written 
submissions. All of the oral and written submissions are listed at the end of the 
document. 


The Committee extends its appreciation to staff of the Ministry of Health and 
Long-Term Care for their attendance at the hearings and to all those who made 
submissions. The Committee also acknowledges the assistance provided during 
the hearings and report writing by the Ministry of Health and Long-Term Care, 


' Personal Health Information Protection Act, S.O. 2004, c. 3, Sch. A. E-laws Internet site at 
http://www.e-laws.gov.on.ca/htmI/statutes/english/elaws_statutes_04p03_e.htm. 
? Committee Hansard may be accessed at http://www.ontla.on.ca/web/committee- 


proceedings/committee_transcripts details.do?locale=en& Date=2008-08- 
28&ParlCommID=8875&BilllID=& Business=Review+of+the+Personalt+Health+Information+Prot 


ection+Act%2C+2004. 


the Clerk of the Committee, and staff of the Legislative Library’s Research and 
Information Services. 


This Report 


This report emphasizes priority recommendations that require further action. The 
context of these recommendations is PH/PA’s status as the only provincial health 
information privacy legislation that has been declared substantially similar to the 
federal Personal Information Protection and Electronic Documents Act 
(PIPEDA).? 


A notice published by Industry Canada in the Canada Gazette regarding the 
criteria for attaining “substantially similar” status provided that provincial 
legislation must incorporate the ten principles set out in Schedule 1 to PIPEDA, 
which is the Model Code for the Protection of Personal Information developed by 
the Canadian Standards Association. For example, section 4.3.4 of the Code 
provides that the express consent of individuals must be required for the 
collection, use, and disclosure of sensitive information, including medical 
records." 


The importance of PHJPA maintaining this designation is that harmonizing 
federal and provincial requirements in regard to personal health information 
makes privacy law easier for individuals to understand and for organizations to 
implement.” 


LOCKBOX 


The term “lockbox” is not specifically defined in the legislation. The rule in 
PHIPA that enables a patient to expressly withdraw or withhold consent to the 
collection, use or disclosure of personal health information for the purpose of 
providing or assisting in the provision of health care to that patient has been 
referred to as the “lock box.” Sections 20(2), 37(1)(a), 38(1)(a) and 50(1)(e) of 
PHIPA provide patients with the opportunity to place limits on the collection, use 
and disclosure of their personal health information. The Committee heard that the 
lockbox is working well, is integral, and should be maintained in its current form. 


> On December 14, 2005, an order of the Governor in Council was published in the Canada 
Gazette declaring PHIPA to be “substantially similar” to Part 1 of PIPEDA. The order exempted 
health information custodians and their agents, as defined in PHIPA, from the application of 
PIPEDA in respect of the collection, use and disclosure of personal information that occurs within 
the Province of Ontario. Canada Gazette, Vol. 139, No. 25 — December 14, 2005. Internet site at 
http://canadagazette.gc.ca/partl1/2005/20051214/html/sor399-e. html. 

“Schedule 1 of PIPEDA incorporating the Principles set out in the National Standard of Canada 
entitled Model Code for the Protection of Personal Information, CAN/CSA-Q830-96, may be 
accessed at http://laws.justice.gc.ca/en/showdoc/cs/P-8.6/sc:1//en?noCookie/. 

> Government of Canada, Canada Gazette, Health Information Custodians in the Province of 
Ontario Exemption Order, Regulatory Impact Analysis Statement, Vol. 139, No. 6, February 5, 


2005. Internet site at http://canadagazette. gc.ca/partl/2005/20050205/html/regle4-e.html. 


Recommendation 1 


There should be no change to the lockbox provisions in PHIPA. 





SHARING OF PERSONAL HEALTH INFORMATION WITH FAMILIES AND 
FRIENDS PROVIDING CARE 


Currently, PHIPA allows the disclosure of personal health information with the 
implied consent of the patient, but only to health information custodians who 
form part of the “circle of care” (discussed on p 7).° 


Family members of patients with mental health issues told the Committee that 
they had great difficulty obtaining information about their family member from 
health information custodians. This was the case even when the patient was being 
discharged into their care. In one instance, a mother was unable to find out 
whether her child had been admitted to hospital or released.’ The witness told the 
Committee that “I am good enough to pay bills and support him, but I’m not good 
enough to have any information or relate any information to the treating teams or 
doctors or hospitals.”® Some witnesses requested amendments to section 38(3) of 
the Act to permit the sharing of personal health information with family and 
friends without the consent of the patient. 


In its deliberations, the Committee considered the importance of maintaining 
PHIPA’s designation as “substantially similar” legislation to PIPEDA. As 
indicated above, s. 4.3.4 of Schedule 1 to PJPEDA requires organizations to 
obtain express consent for the collection, use and disclosure of sensitive 
information, including medical records. 


The Committee proposes to address the issue of access to personal health 
information by friends and family without altering the requirement that the 


express consent of the patient be obtained in order for such information to be 
shared. 


Recommendation 2 


Consideration should be given to a PHIPA amendment requiring health care 


institutions to ask patients or residents whether they consent to the disclosure 
of their personal health information to family members or friends who care 
for them. 





© The term “health information custodian” is defined in PH/PA. Health information custodians 
include health care practitioners, service providers under the Long-Term Care Act, 1994, and 
others outlined in s. 3(1) of PHIPA and s. 3 of O. Reg. 329/04 under the Act. 

” See the submission on behalf of the Schizophrenic Society of Ontario, East York Chapter, 28 
August 2008. 

* Ibid. 





BREACH NOTIFICATION 


Some witnesses asked the Committee to recommend an amendment to the breach 
notification requirement in s. 12(2) of PHJPA. Currently, s. 12(2) provides as 
follows: 


12. (2) Subject to subsection (3) and subject to 
the exceptions and additional requirements, if 
any, that are prescribed, a health information 
custodian that has custody or control of personal 
health information about an individual shall 
notify the individual at the first reasonable 
opportunity if the information is stolen, lost, or 
accessed by unauthorized persons. 


Ontario’s IPC asked for an amendment permitting the Commissioner to authorize 
health information custodians to relax this requirement in certain circumstances. 
According to the IPC, in some situations the minimal risk posed to personal 
privacy outweighs the potential impact of a notification. 


In contrast, the Ministry of Health and Long-Term Care told the Committee that 
the provision should not be amended. Generally speaking, according to the 
Ministry, breach notification provisions are increasingly common in legislation. 
They promote transparent information practices. They also reinforce the 
confidence of patients in the operation of the health system. Finally, the issuance 
of a breach notification is a powerful educational tool for the organization 
required to do so. 


The Committee accepts the submissions of the Ministry of Health and Long-Term 
care on this issue. Minimal risk is in the eye of the beholder. In other words, 
because of its sensitivity, health information custodians should be required to 
notify an individual if their personal health information has been stolen, lost or 
accessed by unauthorized persons. 


Recommendation 3 


There should be no amendment to the breach notification requirement in 
section 12(2) of the Personal Health Information Protection Act, 2004. 





THE INSURANCE SECTOR AND PHIPA 


The Committee heard evidence from the Ontario Psychological Association 
(OPA) about the personal health information practices of some insurance 
companies. According to the OPA, psychologists are often asked for information 
that appears to exceed what is required to determine eligibility for insurance 
coverage. The OPA asked that insurers be classified as health information 


custodians under PH/PA in order to control their collection, use and disclosure of 
personal health information. 


In its deliberations, the Committee has considered the regulation of insurance 
companies by the federal private-sector privacy legislation, PI[PEDA. The 
Committee examined the federal Privacy Commissioner’s 2007 Annual Report to 
Parliament in which the Commissioner indicated that 35 of the 350 complaints 
the Office had received under PIPEDA concerned the insurance sector.’ In 
September 2008 the Federal Court of Appeal held that the relationship between an 
insured and an insurer was commercial in nature, and therefore within PJPEDA’s 
scope. 


Recommendation 4 


Insurance companies should remain outside the scope of the Act. 





FEES 


Section 54(11) of PHIPA provides that the fee charged by a health information 
custodian for making a record or part of a personal health information record 
available to an individual shall not exceed the amount outlined in regulations 
under the Act; nor shall it exceed the amount required for reasonable cost 
recovery. Currently, there are no regulations concerning fees under the Act. 


The Committee heard evidence from some witnesses regarding fees charged by 
health information custodians for copies of health records. The Ministry of 
Health and Long-Term Care reported that in 2006, a proposed fee schedule was 
published in the Ontario Gazette. The Ministry conducted a sixty-day 
consultation in which opinions expressing a variety of views were received. 


Some health profession regulatory bodies, such as the College of Physicians and 
Surgeons of Ontario, have established recommended minimum fees which may be 
charged. The Advocacy Centre for the Elderly told the Committee that some 
clients had been asked to pay as much as $150 for a few pages of their record. 

The IPC told the Committee that it had responded to numerous complaints and 
inquiries from members of the public regarding the fees charged by health 
information custodians. The IPC asked the Committee to consider a regulation 
prescribing the fee that may be charged by a health information custodian for 
copies of a record. 


° Canada, Office of the Privacy Commissioner, Annual Report to Parliament, 2007 (Ottawa: 
Minister of Public Works and Government Services, 2008), p. 69. Internet site at 


http://www.privcom.ge.ca/information/ar/200708/2007_pipeda_e.pdf. 
'° Wyndowe v. Rousseau, 2008 FCA 39, paragraphs 34-36. Internet site at http://decisions. fca- 


caf.gc.ca/en/2008/2008fca39/2008fca39.pdf. 


Recommendation 5 


There should be a regulation setting fees that may be charged by health 
information custodians for the disclosure of personal health information. 
The regulation should also prescribe fees that may be charged by health 


information custodians for making a record available to an individual as well 
as for providing copies of all or part of a personal health record. 
“Reasonable” cost recovery should not be left to the discretion of health 
information custodians and their agents. 





RELEASE OF PERSONAL HEALTH INFORMATION BY POLICE 


The Committee heard that in response to requests by employers for police record 
checks, information regarding contact between individuals and police under 
section 17 of the Mental Health Act is sometimes released. This information may 
have been disclosed under s. 41(1.1) of the Police Services Act and O. Reg. 
265/98 under that Act. When a prospective employer or organization seeking 
volunteers has access to this kind of information, certain unfair and incorrect 
assumptions may be made about the suitability of a candidate for a particular 
position. 


On November 28, 2007, the Ontario Human Rights Commission (OHRC) 
released a draft paper for public consultation entitled Policy on Mental Health 
Discrimination and Police Record Checks.''! The purpose of the public 
consultation is the development of a draft policy for organizations requesting 
police reference checks. 


In 2006, the Information and Privacy Commissioner/Ontario received two 
complaints about the mental health record disclosure practices of an Ontario 
police service. In its decision concerning these complaints, the IPC noted that 
some police services in Ontario have adopted a risk-based approach to this issue. 
In other words, before releasing police records in response to a request, the police 
service assesses the risk posed by an individual. 


In this regard the Committee is aware of the practices adopted by the London 
Police Service, where mental health information is released as part of a police 
record only if the safety of others was at risk during the police contact. 


Although personal health information has acquired protected status under PHIPA, 
this information becomes vulnerable once it enters a police record and falls 
outside the legislation. 


'' The OHRC draft policy may be accessed at 
http://www.ohrc.on.ca/en/resources/Policies/mhdraft. 


Recommendation 6 


In order to protect the integrity of PHIPA, best practices should be established 
with respect to the disclosure of personal health information by police 
services. The Ministry of Health and Long-Term Care should work with 


stakeholders, including police services, to prevent unnecessary and 
detrimental disclosures of personal health information gathered during a 
Mental Health Act intervention by police services. If there is no indication 
that the person poses a safety risk to others, mental health information should 
not be disclosed as part of a police record check. 





CIRCLE OF CARE 


The Committee heard that health information custodians are not clear about the 
persons to whom they may disclose personal health information. The phrase 
“circle of care” is sometimes used to describe health providers who are working 
together to make care decisions for a patient. As noted earlier in this report, 
section 20(2) of PHIPA provides that certain health information custodians may 
assume the implied consent of the individual to disclose personal health 
information to another custodian within the circle of care. While some witnesses 
suggested that this “circle of care” was too broad, others said that there was a lack 
of consistency in the disclosure practices of health care facilities. As a result, in 
some cases family practitioners have been unable to obtain personal health 
information about their patient. 


The Committee is aware that the concept embodied by the phrase “circle of care” 
is dealt with slightly differently in the legislation of other jurisdictions. 


Recommendation 7 


The Ministry of Health and Long-Term Care should examine the use of the 


term “circle of care” in other jurisdictions to see whether experiences 
elsewhere have some application here, and consider whether the term should 
be defined in PHIPA. 





TIME FRAME TO RESPOND TO A REQUEST FOR A RECORD 


Currently, s. 54(2) of PHIPA gives health information custodians up to 30 days to 
respond to a request for access to a record of personal health information. The 
Committee heard from witnesses who asked that the time frame to respond to a 
request be reduced to seven days. 


The Committee is of the opinion that 30 days is too long to respond to a request 
for access to a personal health record. 


Recommendation 8 


The Ministry of Health and Long-Term Care should consider introducing an 


amendment to section 54(2) to give health information custodians ten 
working days to respond to a request for access to a personal health record. 





E-HEALTH 


The term “E-health” describes the application of information and communications 
technologies in the health sector. It encompasses electronic patient administration 
systems in the hospital setting and home care (for example, e-health can be a 
component of home dialysis systems). General practitioners and pharmacists may 
use e-health to manage patients, facilitate electronic prescribing, and maintain 
medical records. 


The Ministry of Health and Long-Term Care told the Committee that the 
regulation-making power over e-health in s. 73(1)(h) of the Act was drafted at a 
time when some current applications of e-health were unforeseen. The Act 
currently provides as follows: 


73. (1) Subject to section 74, the Lieutenant 
Governor in Council may make regulations, 


(h) specifying requirements, or a process for 
setting requirements, for the purposes of | 
subsection 10(3) with which a health 
information custodian is required to comply 
when using electronic means to collect, use, 
modify, disclose, retain or dispose of personal 
health information, including standards for 
transactions, data elements for transactions, 
code sets for data elements and procedures for 
the transmission and authentication of electronic 
signatures. 


Section 10(3) in turn provides as follows: 


10. (3) A health information custodian that uses 
electronic means to collect, use, modify, 
disclose, retain or dispose of personal health 
information shall comply with the prescribed 
requirements, if any. 


The Ministry asked the Committee to consider proposing an amendment to this 
provision which would allow regulations to be made that reflect current and future 
e-health applications. 


The Committee also heard from various witnesses with respect to the evolving 
importance of e-health. The Committee wishes to underscore the importance of 
accelerating e-health initiatives. In its deliberations, the Committee examined 
Newfoundland’s Personal Health Information Protection Act (not yet 
proclaimed), which provides comprehensive regulation-making powers 
concerning e-health matters. The Newfoundland statute provides as follows: 


90. (1) The Lieutenant Governor in Council may 
make regulations, 


(1) respecting the creation, retention, disposition 
and reproduction of records of personal health 
information in electronic form, including 
integrated records of personal health 
information... 


(2) For the purpose of paragraphs [(1)(i)], the 
regulations that may be made may include 
provisions respecting 


(a) the technology or process that shall be used 
to make or send an electronic record; 


(b) the format of an electronic record, including 
the making and verification of an electronic 
signature; 


(c) the place where an electronic record may be 
made or sent; 


(d) the time and circumstances when an 
electronic document is to be considered to be 


10 





sent or received where it is considered to have 
been sent or received; and 


(e) the procedure for responding to a request for 
access to or disclosure of a record of personal 
health information by a person outside the 
province. 7 


Recommendation 9 


Section 73(1)(h) should be amended to allow the development of a more 


comprehensive range of regulations related to e-health with a view to 
accelerating e-health initiatives. 





PUBLIC EDUCATION 


The Committee heard about a public opinion survey conducted by Ekos, a market 
research consulting firm, in June/July 2007. While 88% of Canadian survey 
respondents supported the development of an e-health record, 45% worried that 
personal information in their e-record might be accessed for the wrong reasons. 


In light of the importance attached to the privacy of e-health records, the 
Committee believes that there should be renewed efforts to educate Ontarians 
about the control they have under PHIPA with respect to the collection, use and 
disclosure of their personal health information. 


Section 66(b) of PHIPA currently provides that the IPC may conduct public 
education programs and provide information concerning the Act and the 
Commissioner’s role and activities. 


Recommendation 10 


The Ministry of Health and Long-Term Care should educate Ontarians about 


the control they have over the collection, use and disclosure of their personal 
health information under PHIPA. Further, the IPC should emphasize this 
issue in its public education campaigns. 





'2 Personal Health Information Act, S.N.L. 2008, c. P-70.1. Internet site at 
http://www.canlii.org/nl/laws/sta/p-7.01/20080818/whole.html. 
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